rule:
  meta:
    name: spawn thread to RWX shellcode
    namespace: load-code/shellcode
    author: moritz.raabe@fireeye.com
    scope: function
  features:
    - and:
      - match: allocate RWX memory
      - match: create thread